Skill gallery: manage your skills, install scanned ones

The Yerel (local) view in the project’s Details → Otomasyon → Skill’ler tab lists the skills installed for this project and for all projects.

• Claude Code uses .claude/skills and ~/.claude/skills, Codex uses .agents/skills and ~/.codex/skills.
• “Yeni skill” creates one: pick the agent (Claude Code or Codex) and the scope (this project or all projects), then give a name and when it should be used.
• Turn a skill on or off with a switch: a disabled skill moves to a folder the CLIs don’t scan and comes back unchanged.
• Preview and edit SKILL.md, or copy a skill to another agent or scope.
• Deleted skills go to the Trash.

The Keşfet (discover) view shows your organizations’ skills and the public gallery. Search, filter by 10 categories (coding, testing, code review, DevOps, data, docs, design, security, productivity, other) and by agent, and sort by popular or new. You can also browse the gallery in a browser at app.agentvera.dev/skills.

• The detail view shows SKILL.md, the files, the server scan’s Security result and the versions.
• “İndir ve tara” (download and scan) checks the files’ SHA-256 hash and rescans the skill on this computer; “Kur” (install) comes after that.
• Scripts are written as plain files and never made executable.
• When a new version is out, an update button appears next to the installed skill.

You publish a skill with a title, a 20–300 character summary, up to 6 tags, a category and a semver version; each new version gets a changelog. The Yayınladıklarım (my published) view lists what you’ve shared.

• Organisation only: members see it right away if the scan finds nothing high or critical; otherwise publishing is refused.
• Public: it goes live once a moderator approves it; skills with a critical finding aren’t accepted.
• Limits: up to 50 files, 256 KB per file, 1 MB in total, text files only.

The same scan runs on the server when you publish and on this computer when you install. It looks for destructive or privileged commands, reading secrets and keys embedded in the skill, sending data out, downloading and running code, obfuscated code, prompt injection, hidden Unicode characters, raw IP addresses and outside hosts. The result is shown as clean, info, low, medium, high risk or critical.